If an organization has a policy against uploading sensitive data to third parties, what option would facilitate providing evidence to the HITRUST QA team to support maturity level scoring?
HITRUST accommodates organizations that cannot upload sensitive evidence to the MyCSF portal due to corporate or regulatory policies. The mechanism for this is QA Tasks. Through QA Tasks, HITRUST QA reviewers can request clarifications, additional evidence, or narrative responses, which can be provided without uploading sensitive raw data. This method allows entities to describe processes, reference documents, or provide redacted information while maintaining compliance with their internal data-handling policies. Options such as “Live QA” or “Onsite visits” are not part of the standard assurance program workflow. Escalated QA refers to dispute resolution or additional reviews and does not address evidence handling. QA Tasks are the standard method HITRUST uses to facilitate communication and evidence review without violating data-handling restrictions.
[References: HITRUST Assurance Program Requirements – “QA Task Process”; CCSFP Study Guide – “Evidence Handling in QA.”, , ]
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit